[BUG] ICE in void llvm::function_ref<void ()>::callback_fn<clang::CodeGen::CodeGenFunction::EmitLValue(clang::Expr const*, clang::CodeGen::KnownNonNull_t)::{lambda()#1}>(long)

## Bug Report: ICE in void llvm::function_ref::callback_fn(long)

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
#include
a() {
va_list ap;
va_arg(ap, int());
}

```

## Crash Output

```
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:20:19: error: second argument to 'va_arg' is of non-POD type 'int ()' [-Wnon-pod-varargs]
20 | if (va_arg (ap, TYPE) != 1)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:15:14: note: expanded from macro 'TYPE'
15 | #define TYPE int()
| ^\~\~\~\~
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h:20:47: note: expanded from macro 'va_arg'
20 | #define va_arg(ap, type) __builtin_va_arg(ap, type)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:20:25: warning: comparison between pointer and integer ('int (*)()' and 'int') [-Wpointer-integer-compare]
20 | if (va_arg (ap, TYPE) != 1)
| \~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~ ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:22:19: error: second argument to 'va_arg' is of non-POD type 'int ()' [-Wnon-pod-varargs]
22 | if (va_arg (ap, TYPE) != 2)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:15:14: note: expanded from macro 'TYPE'
15 | #define TYPE int()
| ^\~\~\~\~
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h:20:47: note: expanded from macro 'va_arg'
20 | #define va_arg(ap, type) __builtin_va_arg(ap, type)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:22:25: warning: comparison between pointer and integer ('int (*)()' and 'int') [-Wpointer-integer-compare]
22 | if (va_arg (ap, TYPE) != 2)
| \~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~ ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:24:19: error: second argument to 'va_arg' is of non-POD type 'int ()' [-Wnon-pod-varargs]
24 | if (va_arg (ap, TYPE) != 3)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:15:14: note: expanded from macro 'TYPE'
15 | #define TYPE int()
| ^\~\~\~\~
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h:20:47: note: expanded from macro 'va_arg'
20 | #define va_arg(ap, type) __builtin_va_arg(ap, type)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:24:25: warning: comparison between pointer and integer ('int (*)()' and 'int') [-Wpointer-integer-compare]
24 | if (va_arg (ap, TYPE) != 3)
| \~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~ ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:26:19: error: second argument to 'va_arg' is of non-POD type 'int ()' [-Wnon-pod-varargs]
26 | if (va_arg (ap, TYPE) != 4)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:15:14: note: expanded from macro 'TYPE'
15 | #define TYPE int()
| ^\~\~\~\~
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h:20:47: note: expanded from macro 'va_arg'
20 | #define va_arg(ap, type) __builtin_va_arg(ap, type)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:26:25: warning: comparison between pointer and integer ('int (*)()' and 'int') [-Wpointer-integer-compare]
26 | if (va_arg (ap, TYPE) != 4)
| \~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~ ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:28:19: error: second argument to 'va_arg' is of non-POD type 'int ()' [-Wnon-pod-varargs]
28 | if (va_arg (ap, TYPE) != 5)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:15:14: note: expanded from macro 'TYPE'
15 | #define TYPE int()
| ^\~\~\~\~
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h:20:47: note: expanded from macro 'va_arg'
20 | #define va_arg(ap, type) __builtin_va_arg(ap, type)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:28:25: warning: comparison between pointer and integer ('int (*)()' and 'int') [-Wpointer-integer-compare]
28 | if (va_arg (ap, TYPE) != 5)
| \~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~ ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:30:19: error: second argument to 'va_arg' is of non-POD type 'int ()' [-Wnon-pod-varargs]
30 | if (va_arg (ap, TYPE) != 6)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:15:14: note: expanded from macro 'TYPE'
15 | #define TYPE int()
| ^\~\~\~\~
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h:20:47: note: expanded from macro 'va_arg'
20 | #define va_arg(ap, type) __builtin_va_arg(ap, type)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:30:25: warning: comparison between pointer and integer ('int (*)()' and 'int') [-Wpointer-integer-compare]
30 | if (va_arg (ap, TYPE) != 6)
| \~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~ ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:32:19: error: second argument to 'va_arg' is of non-POD type 'int ()' [-Wnon-pod-varargs]
32 | if (va_arg (ap, TYPE) != 7)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:15:14: note: expanded from macro 'TYPE'
15 | #define TYPE int()
| ^\~\~\~\~
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h:20:47: note: expanded from macro 'va_arg'
20 | #define va_arg(ap, type) __builtin_va_arg(ap, type)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:32:25: warning: comparison between pointer and integer ('int (*)()' and 'int') [-Wpointer-integer-compare]
32 | if (va_arg (ap, TYPE) != 7)
| \~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~ ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:34:19: error: second argument to 'va_arg' is of non-POD type 'int ()' [-Wnon-pod-varargs]
34 | if (va_arg (ap, TYPE) != 8)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:15:14: note: expanded from macro 'TYPE'
15 | #define TYPE int()
| ^\~\~\~\~
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h:20:47: note: expanded from macro 'va_arg'
20 | #define va_arg(ap, type) __builtin_va_arg(ap, type)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:34:25: warning: comparison between pointer and integer ('int (*)()' and 'int') [-Wpointer-integer-compare]
34 | if (va_arg (ap, TYPE) != 8)
| \~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~ ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:36:19: error: second argument to 'va_arg' is of non-POD type 'int ()' [-Wnon-pod-varargs]
36 | if (va_arg (ap, TYPE) != 9)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:15:14: note: expanded from macro 'TYPE'
15 | #define TYPE int()
| ^\~\~\~\~
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h:20:47: note: expanded from macro 'va_arg'
20 | #define va_arg(ap, type) __builtin_va_arg(ap, type)
| ^\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:36:25: warning: comparison between pointer and integer ('int (*)()' and 'int') [-Wpointer-integer-compare]
36 | if (va_arg (ap, TYPE) != 9)
| \~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~ ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:43:3: error: call to undeclared library function 'exit' with type 'void (int) __attribute__((noreturn))'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
43 | exit(0);
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:43:3: note: include the header or explicitly provide a declaration for 'exit'
clang-22: /root/compilers/llvm-project-release/clang/lib/CodeGen/CGExprAgg.cpp:2182: clang::CodeGen::LValue clang::CodeGen::CodeGenFunction::EmitAggExprToLValue(const clang::Expr*): Assertion \`hasAggregateEvaluationKind(E->getType()) && "Invalid argument!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name QgTGvOfKoZuD_surfuzz_18.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/QgTGvOfKoZuD_surfuzz_18-77aa26.o -x c /root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c
1\. parser at end of file
2\. Per-file LLVM IR generation
3\. /root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c:16:13: Generating code for declaration 'vafunction'
#0 0x00005644d352e2d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x00005644d352acaf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x00005644d352adfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f99bf2ce520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f99bf322a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f99bf322a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f99bf322a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f99bf2ce476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f99bf2b47f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f99bf2b471b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f99bf2c5e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x00005644d38abeef (/root/objects/llvm-project-release.obj/bin/clang-22+0x4873eef)
#12 0x00005644d389ae9e clang::CodeGen::CodeGenFunction::EmitLValueHelper(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4862e9e)
#13 0x00005644d389babe void llvm::function_ref::callback_fn(long) CGExpr.cpp:0:0
#14 0x00005644d78a1a73 clang::StackExhaustionHandler::runWithSufficientStackSpace(clang::SourceLocation, llvm::function_ref) (/root/objects/llvm-project-release.obj/bin/clang-22+0x8869a73)
#15 0x00005644d3863e4b clang::CodeGen::CodeGenFunction::EmitLValue(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/root/objects/llvm-project-release.obj/bin/clang-22+0x482be4b)
#16 0x00005644d3908574 (anonymous namespace)::ScalarExprEmitter::VisitCastExpr(clang::CastExpr*) CGExprScalar.cpp:0:0
#17 0x00005644d38ff5da (anonymous namespace)::ScalarExprEmitter::Visit(clang::Expr*) CGExprScalar.cpp:0:0
#18 0x00005644d390c32e clang::CodeGen::CodeGenFunction::EmitPromotedScalarExpr(clang::Expr const*, clang::QualType) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48d432e)
#19 0x00005644d390ccee (anonymous namespace)::ScalarExprEmitter::EmitBinOps(clang::BinaryOperator const*, clang::QualType) CGExprScalar.cpp:0:0
#20 0x00005644d390e96d (anonymous namespace)::ScalarExprEmitter::EmitCompare(clang::BinaryOperator const*, llvm::CmpInst::Predicate, llvm::CmpInst::Predicate, llvm::CmpInst::Predicate, bool) CGExprScalar.cpp:0:0
#21 0x00005644d3903232 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48cb232)
#22 0x00005644d386c4ed clang::CodeGen::CodeGenFunction::EvaluateExprAsBool(clang::Expr const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48344ed)
#23 0x00005644d3aad897 clang::CodeGen::CodeGenFunction::EmitBranchOnBoolExpr(clang::Expr const*, llvm::BasicBlock*, llvm::BasicBlock*, unsigned long, clang::Stmt::Likelihood, clang::Expr const*, clang::VarDecl const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a75897)
#24 0x00005644d3a3ee77 clang::CodeGen::CodeGenFunction::EmitIfStmt(clang::IfStmt const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a06e77)
#25 0x00005644d3a3f78b clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a0778b)
#26 0x00005644d3aa79e3 clang::CodeGen::CodeGenFunction::EmitFunctionBody(clang::Stmt const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a6f9e3)
#27 0x00005644d3abce84 clang::CodeGen::CodeGenFunction::GenerateCode(clang::GlobalDecl, llvm::Function*, clang::CodeGen::CGFunctionInfo const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a84e84)
#28 0x00005644d3b20f0d clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae8f0d)
#29 0x00005644d3b1bef5 clang::CodeGen::CodeGenModule::EmitGlobalDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae3ef5)
#30 0x00005644d3b27fbe clang::CodeGen::CodeGenModule::EmitDeferred() (/root/objects/llvm-project-release.obj/bin/clang-22+0x4aeffbe)
#31 0x00005644d3b2ad8b clang::CodeGen::CodeGenModule::Release() (/root/objects/llvm-project-release.obj/bin/clang-22+0x4af2d8b)
#32 0x00005644d3ea2171 (anonymous namespace)::CodeGeneratorImpl::HandleTranslationUnit(clang::ASTContext&) ModuleBuilder.cpp:0:0
#33 0x00005644d3e9f1ed clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4e671ed)
#34 0x00005644d5d3fafc clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d07afc)
#35 0x00005644d41b7987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#36 0x00005644d413f0e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#37 0x00005644d42b495e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#38 0x00005644cffbf657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#39 0x00005644cffb4694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#40 0x00005644cffb9907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#41 0x00005644cfe770ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#42 0x00007f99bf2b5d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#43 0x00007f99bf2b5e40 call_init ./csu/../csu/libc-start.c:128:20
#44 0x00007f99bf2b5e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#45 0x00005644cffb3cb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/QgTGvOfKoZuD_surfuzz_18-a10ac5.c
clang: note: diagnostic msg: /tmp/QgTGvOfKoZuD_surfuzz_18-a10ac5.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/QgTGvOfKoZuD_surfuzz_18-a10ac5.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* stdarg.h expanded by -frewrite-includes */
#include
#else /* stdarg.h expanded by -frewrite-includes */
# 1 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 1 3
/*===---- stdarg.h - Variable argument handling ----------------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

/*
* This header is designed to be included multiple times. If any of the __need_
* macros are defined, then only that subset of interfaces are provided. This
* can be useful for POSIX headers that need to not expose all of stdarg.h, but
* need to use some of its interfaces. Otherwise this header provides all of
* the expected interfaces.
*
* When clang modules are enabled, this header is a textual header to support
* the multiple include behavior. As such, it doesn't directly declare anything
* so that it doesn't add duplicate declarations to all of its includers'
* modules.
*/
#if 0 /* disabled by -frewrite-includes */
#if defined(__MVS__) && __has_include_next()
#endif
#endif /* disabled by -frewrite-includes */
#if 0 /* evaluated by -frewrite-includes */
# 23 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#undef __need___va_list
#undef __need_va_list
#undef __need_va_arg
#undef __need___va_copy
#undef __need_va_copy
#if 0 /* expanded by -frewrite-includes */
#include <__stdarg_header_macro.h>
#endif /* expanded by -frewrite-includes */
# 28 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 29 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#if 0 /* expanded by -frewrite-includes */
#include_next
#endif /* expanded by -frewrite-includes */
# 29 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 30 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#else
# 32 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#if 0 /* disabled by -frewrite-includes */
#if !defined(__need___va_list) && !defined(__need_va_list) && \
!defined(__need_va_arg) && !defined(__need___va_copy) && \
!defined(__need_va_copy)
#endif
#endif /* disabled by -frewrite-includes */
#if 1 /* evaluated by -frewrite-includes */
# 35 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#define __need___va_list
#define __need_va_list
#define __need_va_arg
#define __need___va_copy
/* GCC always defines __va_copy, but does not define va_copy unless in c99 mode
* or -ansi is not specified, since it was not part of C90.
*/
#if 0 /* disabled by -frewrite-includes */
#if (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L) || \
(defined(__cplusplus) && __cplusplus >= 201103L) || \
!defined(__STRICT_ANSI__)
#endif
#endif /* disabled by -frewrite-includes */
#if 1 /* evaluated by -frewrite-includes */
# 45 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#define __need_va_copy
#endif
# 47 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg_header_macro.h expanded by -frewrite-includes */
#include <__stdarg_header_macro.h>
#else /* __stdarg_header_macro.h expanded by -frewrite-includes */
# 47 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_header_macro.h" 1 3
/*===---- __stdarg_header_macro.h ------------------------------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef __STDARG_H
#define __STDARG_H
#endif
# 13 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_header_macro.h" 3
#endif /* __stdarg_header_macro.h expanded by -frewrite-includes */
# 48 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#endif
# 49 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need___va_list
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg___gnuc_va_list.h expanded by -frewrite-includes */
#include <__stdarg___gnuc_va_list.h>
#else /* __stdarg___gnuc_va_list.h expanded by -frewrite-includes */
# 51 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg___gnuc_va_list.h" 1 3
/*===---- __stdarg___gnuc_va_list.h - Definition of __gnuc_va_list ---------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef __GNUC_VA_LIST
#define __GNUC_VA_LIST
typedef __builtin_va_list __gnuc_va_list;
#endif
# 14 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg___gnuc_va_list.h" 3
#endif /* __stdarg___gnuc_va_list.h expanded by -frewrite-includes */
# 52 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need___va_list
#endif /* defined(__need___va_list) */
# 54 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need_va_list
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg_va_list.h expanded by -frewrite-includes */
#include <__stdarg_va_list.h>
#else /* __stdarg_va_list.h expanded by -frewrite-includes */
# 56 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_list.h" 1 3
/*===---- __stdarg_va_list.h - Definition of va_list -----------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef _VA_LIST
#define _VA_LIST
typedef __builtin_va_list va_list;
#endif
# 14 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_list.h" 3
#endif /* __stdarg_va_list.h expanded by -frewrite-includes */
# 57 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need_va_list
#endif /* defined(__need_va_list) */
# 59 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need_va_arg
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg_va_arg.h expanded by -frewrite-includes */
#include <__stdarg_va_arg.h>
#else /* __stdarg_va_arg.h expanded by -frewrite-includes */
# 61 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 1 3
/*===---- __stdarg_va_arg.h - Definitions of va_start, va_arg, va_end-------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef va_arg

#if 0 /* disabled by -frewrite-includes */
#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 202311L
#endif
#endif /* disabled by -frewrite-includes */
#if 0 /* evaluated by -frewrite-includes */
# 13 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 3
/* C23 uses a special builtin. */
#define va_start(...) __builtin_c23_va_start(__VA_ARGS__)
#else
# 16 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 3
/* Versions before C23 do require the second parameter. */
#define va_start(ap, param) __builtin_va_start(ap, param)
#endif
# 19 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 3
#define va_end(ap) __builtin_va_end(ap)
#define va_arg(ap, type) __builtin_va_arg(ap, type)

#endif
# 23 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 3
#endif /* __stdarg_va_arg.h expanded by -frewrite-includes */
# 62 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need_va_arg
#endif /* defined(__need_va_arg) */
# 64 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need___va_copy
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg___va_copy.h expanded by -frewrite-includes */
#include <__stdarg___va_copy.h>
#else /* __stdarg___va_copy.h expanded by -frewrite-includes */
# 66 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg___va_copy.h" 1 3
/*===---- __stdarg___va_copy.h - Definition of __va_copy -------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef __va_copy
#define __va_copy(d, s) __builtin_va_copy(d, s)
#endif
# 13 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg___va_copy.h" 3
#endif /* __stdarg___va_copy.h expanded by -frewrite-includes */
# 67 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need___va_copy
#endif /* defined(__need___va_copy) */
# 69 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need_va_copy
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg_va_copy.h expanded by -frewrite-includes */
#include <__stdarg_va_copy.h>
#else /* __stdarg_va_copy.h expanded by -frewrite-includes */
# 71 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_copy.h" 1 3
/*===---- __stdarg_va_copy.h - Definition of va_copy------------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef va_copy
#define va_copy(dest, src) __builtin_va_copy(dest, src)
#endif
# 13 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_copy.h" 3
#endif /* __stdarg_va_copy.h expanded by -frewrite-includes */
# 72 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need_va_copy
#endif /* defined(__need_va_copy) */
# 74 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#endif /* __MVS__ */
# 76 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#endif /* stdarg.h expanded by -frewrite-includes */
# 2 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c" 2
#if 0 /* disabled by -frewrite-includes */
#if defined (__GNUC__)
#endif
#endif /* disabled by -frewrite-includes */
#if 1 /* evaluated by -frewrite-includes */
# 3 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
#define abort() __builtin_abort ()
#else
# 5 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
#ifdef _MSC_VER
#define abort() __debugbreak()
#else
# 8 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
#if 0 /* disabled by -frewrite-includes */
#if defined(__IBMC__) || defined(__IBMCPP__)
#endif
#endif /* disabled by -frewrite-includes */
#if 0 /* evaluated by -frewrite-includes */
# 9 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
#define abort() __debugbreak( )
#else
# 11 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
#error unsupported toolset for debug abort
#endif
# 13 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
#endif
# 14 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
#endif
# 15 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
#define TYPE int()
static void vafunction(const char *dummy,...)
{
va_list ap;
va_start(ap, dummy);
if (va_arg (ap, TYPE) != 1)
abort();
if (va_arg (ap, TYPE) != 2)
abort();
if (va_arg (ap, TYPE) != 3)
abort();
if (va_arg (ap, TYPE) != 4)
abort();
if (va_arg (ap, TYPE) != 5)
abort();
if (va_arg (ap, TYPE) != 6)
abort();
if (va_arg (ap, TYPE) != 7)
abort();
if (va_arg (ap, TYPE) != 8)
abort();
if (va_arg (ap, TYPE) != 9)
abort();
va_end(ap);
}
int main (void)
{
vafunction( "", 1, 2, 3, 4, 5, 6, 7, 8, 9 );
exit(0);
return 0;
}

```

**Run script** (`/tmp/QgTGvOfKoZuD_surfuzz_18-a10ac5.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "QgTGvOfKoZuD_surfuzz_18.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/QgTGvOfKoZuD_surfuzz_18-77aa26.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,clang,2/QgTGvOfKoZuD_surfuzz_18.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "QgTGvOfKoZuD_surfuzz_18.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "QgTGvOfKoZuD_surfuzz_18-a10ac5.c"

```

* found via a fuzzer

[QgTGvOfKoZuD_surfuzz_18-a10ac5.c](https://github.com/user-attachments/files/29126647/QgTGvOfKoZuD_surfuzz_18-a10ac5.c)
[QgTGvOfKoZuD_surfuzz_18-a10ac5.sh](https://github.com/user-attachments/files/29126649/QgTGvOfKoZuD_surfuzz_18-a10ac5.sh)

First reproduce the crash with the supplied test.c command and flags, including -emit-llvm -Xclang -disable-llvm-passes. Then inspect clang/lib/CodeGen/CGExprAgg.cpp around EmitAggExprToLValue and the shown assertion; done means this reduced C input reports diagnostics without an internal compiler crash and has regression coverage.

Written by the indexing model from the issue text.